python:3.11-slim ships CPython 3.11's frozen pip 24.0 and setuptools
79.0.1. OSV lists six pip advisories (CVE-2025-8869, CVE-2026-1703,
CVE-2026-3219, CVE-2026-6357, CVE-2026-8643, CVE-2026-13346; fixed by
26.2) and two setuptools ones (CVE-2026-59890, GHSA-xmj3-9gf7-h52w;
fixed by 84.1.0). Upgrading them first also means the app installs run
under a patched pip.
After the change the image resolves pip 26.2.2 and setuptools 84.2.1,
and an OSV batch query over all 41 installed packages comes back clean
(fastapi 0.162.0, starlette 1.10.0, python-multipart 0.0.33,
uvicorn 0.54.0, faster-whisper 1.2.1, ...). Trivy finds no fixable
Debian 13.7 OS vulnerabilities in the current python:3.11-slim, so no
apt upgrade layer is added. Smoke-tested: /health 200 and /transcribe
200 on a generated WAV.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
shadowdaoandClaude Opus 5.5
1ab386f24b